A New RSA-Based Signature Scheme Sven Sch age, J org Schwenk - PowerPoint PPT Presentation

A New RSA-Based Signature Scheme Sven Sch¨ age, J¨ org Schwenk Horst G¨ ortz Institute for IT-Security Africacrypt 2010 1 / 13

RSA-Based Signature Schemes Na¨ ıve RSA signature scheme not secure under the standard definition of security – adaptive chosen message attacks [GMR99]. 2 / 13

RSA-Based Signature Schemes Na¨ ıve RSA signature scheme not secure under the standard definition of security – adaptive chosen message attacks [GMR99]. RSA assumption is weaker than popular Strong RSA (SRSA) assumption. In contrast to SRSA: adversary is not allowed to choose from an exponentially large set of solutions. 2 / 13

RSA-Based Signature Schemes Na¨ ıve RSA signature scheme not secure under the standard definition of security – adaptive chosen message attacks [GMR99]. RSA assumption is weaker than popular Strong RSA (SRSA) assumption. In contrast to SRSA: adversary is not allowed to choose from an exponentially large set of solutions. Only recently, in CRYPTO’09, Hohenberger and Waters (HW) presented the first hash-and-sign signature scheme that is solely secure under the RSA assumption. 2 / 13

RSA-Based Signature Schemes Na¨ ıve RSA signature scheme not secure under the standard definition of security – adaptive chosen message attacks [GMR99]. RSA assumption is weaker than popular Strong RSA (SRSA) assumption. In contrast to SRSA: adversary is not allowed to choose from an exponentially large set of solutions. Only recently, in CRYPTO’09, Hohenberger and Waters (HW) presented the first hash-and-sign signature scheme that is solely secure under the RSA assumption. In this work: alternative RSA-based signature scheme with additional properties that are useful in privacy preserving systems. 2 / 13

Observations A single HW signature can be interpreted as a combination of several Gennaro-Halevi-Rabin signatures. (Observation 1) 3 / 13

Observations A single HW signature can be interpreted as a combination of several Gennaro-Halevi-Rabin signatures. (Observation 1) The SRSA-based Camenisch-Lysyanskaya (CL) scheme has proven very useful in many privacy preserving systems. Popular examples: Direct Anonymous Attestation (DAA), compact E-Cash. (Observation 2) 3 / 13

Observations A single HW signature can be interpreted as a combination of several Gennaro-Halevi-Rabin signatures. (Observation 1) The SRSA-based Camenisch-Lysyanskaya (CL) scheme has proven very useful in many privacy preserving systems. Popular examples: Direct Anonymous Attestation (DAA), compact E-Cash. (Observation 2) Three useful properties of CL scheme: 3 / 13

Observations A single HW signature can be interpreted as a combination of several Gennaro-Halevi-Rabin signatures. (Observation 1) The SRSA-based Camenisch-Lysyanskaya (CL) scheme has proven very useful in many privacy preserving systems. Popular examples: Direct Anonymous Attestation (DAA), compact E-Cash. (Observation 2) Three useful properties of CL scheme: Signature scheme supports signing several message blocks. 1 3 / 13

Observations A single HW signature can be interpreted as a combination of several Gennaro-Halevi-Rabin signatures. (Observation 1) The SRSA-based Camenisch-Lysyanskaya (CL) scheme has proven very useful in many privacy preserving systems. Popular examples: Direct Anonymous Attestation (DAA), compact E-Cash. (Observation 2) Three useful properties of CL scheme: Signature scheme supports signing several message blocks. 1 There exist efficient (NIZK) protocols (in the ROM) to sign 2 commited values. 3 / 13

Observations A single HW signature can be interpreted as a combination of several Gennaro-Halevi-Rabin signatures. (Observation 1) The SRSA-based Camenisch-Lysyanskaya (CL) scheme has proven very useful in many privacy preserving systems. Popular examples: Direct Anonymous Attestation (DAA), compact E-Cash. (Observation 2) Three useful properties of CL scheme: Signature scheme supports signing several message blocks. 1 There exist efficient (NIZK) protocols (in the ROM) to sign 2 commited values. There exist efficient (NIZK) protocols (in the ROM) for proving 3 knowledge of a signature without revealing it. 3 / 13

Idea and Construction Idea: Combine Observation 1 & Observation 2 4 / 13

Idea and Construction Idea: Combine Observation 1 & Observation 2 Construct signatures that can be interpreted as the combination of several CL signatures. Perhaps the decisive properties of the CL scheme can still be found in the new construction! 4 / 13

Idea and Construction Idea: Combine Observation 1 & Observation 2 Construct signatures that can be interpreted as the combination of several CL signatures. Perhaps the decisive properties of the CL scheme can still be found in the new construction! Technique: 4 / 13

Idea and Construction Idea: Combine Observation 1 & Observation 2 Construct signatures that can be interpreted as the combination of several CL signatures. Perhaps the decisive properties of the CL scheme can still be found in the new construction! Technique: Starting point CL scheme: CL proof considers three types of forgery. 4 / 13

Idea and Construction Idea: Combine Observation 1 & Observation 2 Construct signatures that can be interpreted as the combination of several CL signatures. Perhaps the decisive properties of the CL scheme can still be found in the new construction! Technique: Starting point CL scheme: CL proof considers three types of forgery. Key observation: two of these forgeries already reduce security to the RSA assumption. 4 / 13

Idea and Construction Idea: Combine Observation 1 & Observation 2 Construct signatures that can be interpreted as the combination of several CL signatures. Perhaps the decisive properties of the CL scheme can still be found in the new construction! Technique: Starting point CL scheme: CL proof considers three types of forgery. Key observation: two of these forgeries already reduce security to the RSA assumption. Remaining type of forgery can be dealt with using the new proving techniques of HW. 4 / 13

Idea and Construction Idea: Combine Observation 1 & Observation 2 Construct signatures that can be interpreted as the combination of several CL signatures. Perhaps the decisive properties of the CL scheme can still be found in the new construction! Technique: Starting point CL scheme: CL proof considers three types of forgery. Key observation: two of these forgeries already reduce security to the RSA assumption. Remaining type of forgery can be dealt with using the new proving techniques of HW. In particular: integrate that for a string X all prefixes of X are processed as well. 4 / 13

Idea and Construction Idea: Combine Observation 1 & Observation 2 Construct signatures that can be interpreted as the combination of several CL signatures. Perhaps the decisive properties of the CL scheme can still be found in the new construction! Technique: Starting point CL scheme: CL proof considers three types of forgery. Key observation: two of these forgeries already reduce security to the RSA assumption. Remaining type of forgery can be dealt with using the new proving techniques of HW. In particular: integrate that for a string X all prefixes of X are processed as well. Modified scheme still allows to reduce the first two forgeries to the RSA assumption (although the proof is slightly more complicated). 4 / 13

Contribution: New Signature Scheme with Useful Properties for Anonymity Preserving Systems Advantages Disadvantages 5 / 13

Contribution: New Signature Scheme with Useful Properties for Anonymity Preserving Systems Advantages New scheme supports signing several message blocks Disadvantages 5 / 13

Contribution: New Signature Scheme with Useful Properties for Anonymity Preserving Systems Advantages New scheme supports signing several message blocks New scheme allows to sign commited values Disadvantages 5 / 13

Contribution: New Signature Scheme with Useful Properties for Anonymity Preserving Systems Advantages New scheme supports signing several message blocks New scheme allows to sign commited values Proof technique can be transferred to Cramer-Shoup, Fischlin and Zhou signature scheme ⇒ Several new RSA-based signature schemes! Disadvantages 5 / 13

Contribution: New Signature Scheme with Useful Properties for Anonymity Preserving Systems Advantages New scheme supports signing several message blocks New scheme allows to sign commited values Proof technique can be transferred to Cramer-Shoup, Fischlin and Zhou signature scheme ⇒ Several new RSA-based signature schemes! Disadvantages Signatures are larger than in HW (by just a single exponent) 5 / 13

Contribution: New Signature Scheme with Useful Properties for Anonymity Preserving Systems Advantages New scheme supports signing several message blocks New scheme allows to sign commited values Proof technique can be transferred to Cramer-Shoup, Fischlin and Zhou signature scheme ⇒ Several new RSA-based signature schemes! Disadvantages Signatures are larger than in HW (by just a single exponent) Signature generation and verification take more time 5 / 13